feat(netpols): ship the cert-manager-webhook-linode allow-rule - #3473
Open
aweingarten wants to merge 5 commits into
Open
feat(netpols): ship the cert-manager-webhook-linode allow-rule#3473aweingarten wants to merge 5 commits into
aweingarten wants to merge 5 commits into
Conversation
Under default-deny the apiserver's discovery probe to the linode DNS-01 solver webhook (:443) is dropped, so the aggregated APIService `v1alpha1.acme.slicen.me` stays Available=False with FailedDiscoveryCheck. Convergence then hangs waiting on a certificate that can never be issued, and nothing in the symptom points at a NetworkPolicy. The webhook can't be covered by the policy that already exists: it is deployed by the cert-manager-webhook-linode chart, which labels its pods `app: cert-manager-webhook-linode` with no `app.kubernetes.io/name`, while the cert-manager chart's own webhook policy selects `app.kubernetes.io/name: webhook`. That selector is right for cert-manager's own webhook, so this gets its own rule rather than a widened one. Adds `netpols.certManagerWebhookLinode`, driven by `apps.cert-manager.networkPolicies.enabled` (default false) and only rendered when linode is the configured DNS provider, since that is the only case in which the webhook is installed at all. Refs linode#3387
This was referenced Jul 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an opt-in NetworkPolicy allow-rule for the cert-manager-webhook-linode aggregated APIService webhook so clusters running default-deny policies don’t block the kube-apiserver discovery probe to the webhook on port 443 (preventing FailedDiscoveryCheck / stalled cert issuance).
Changes:
- Introduces
netpols.certManagerWebhookLinode, gated byapps.cert-manager.networkPolicies.enabledand only enabled when the Linode DNS provider is configured. - Adds a new
NetworkPolicytemplate in thecert-managernamespace selectingapp: cert-manager-webhook-linodeand allowing ingress on TCP/443. - Exposes
apps.cert-manager.networkPoliciesin schema + defaults to support the new gating flag.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| values/apl-network-policies/apl-network-policies.gotmpl | Computes netpols.certManagerWebhookLinode based on cert-manager NP enablement and Linode DNS provider presence. |
| values-schema.yaml | Allows apps.cert-manager.networkPolicies via appNetworkPolicyConfig. |
| helmfile.d/snippets/defaults.yaml | Sets default apps.cert-manager.networkPolicies.enabled: false. |
| charts/apl-network-policies/values.yaml | Documents the new cert-manager-webhook-linode policy toggle and behavior. |
| charts/apl-network-policies/templates/networkpolicies/cert-manager-webhook-linode.yaml | Adds the actual NetworkPolicy manifest enabling TCP/443 ingress to the Linode solver webhook pods. |
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: cert-manager-webhook-linode-policy |
| # - Allows ingress from: | ||
| # * anywhere on 443 — the apiserver's discovery probe for the aggregated APIService, which has | ||
| # no address a selector or ipBlock can pin down on a managed control plane | ||
| # - Only rendered when linode is the configured DNS provider |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (1)
charts/apl-network-policies/templates/networkpolicies/cert-manager-webhook-linode.yaml:7
- The new NetworkPolicy name doesn’t follow the established
*-platform-policynaming used by the other policies in this chart (e.g.git-server-platform-policy,gitea-platform-policy,otomi-api-platform-policy). Aligning the name keeps resources consistent and easier to locate/grep.
metadata:
name: cert-manager-webhook-linode-policy
namespace: cert-manager
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 Summary
Second of #3387, after #3470 (ESO webhook). Same shape, different component.
Under default-deny the apiserver's discovery probe to the linode DNS-01 solver webhook (:443) is dropped, so the aggregated APIService
v1alpha1.acme.slicen.mestaysAvailable=FalsewithFailedDiscoveryCheck. Convergence then hangs waiting on a certificate that can never be issued — and nothing in that symptom points at a NetworkPolicy.This one can't be fixed by widening an existing policy. The webhook comes from the
cert-manager-webhook-linodechart, which labels its podsapp: cert-manager-webhook-linodewith noapp.kubernetes.io/name. The cert-manager chart's own webhook policy (charts/cert-manager/templates/networkpolicy-webhooks.yaml) selectsapp.kubernetes.io/name: webhook+component: webhook, which is correct for cert-manager's webhook and shouldn't be loosened to catch a different chart's pods. So this gets its own rule.Adds
netpols.certManagerWebhookLinode, driven byapps.cert-manager.networkPolicies.enabled(default false), rendered only when linode is the configured DNS provider — the only case where the webhook is installed at all.🔍 Reviewer Notes
helm template charts/cert-manager-webhook-linodegives pod labels{app: cert-manager-webhook-linode, release: cert-manager-webhook-linode}, container port 443 (https), andAPIService v1alpha1.acme.slicen.me → service cert-manager-webhook-linode.cert-manager.ports-only rationale as feat(netpols): ship the ESO webhook allow-rule #3470: the apiserver is off the pod network on a managed control plane, so there's nonamespaceSelector/ipBlockthat can express it. Same offer — if you'd rather pin it to the LKE control-plane range, easy change.and (networkPolicies.enabled) (hasKey dns.provider "linode")— enabling cert-manager netpols on a cluster using a different DNS provider shouldn't create a policy selecting pods that don't exist.Ingress-typed, so creating it makes those pods deny any ingress not listed — only the intent on a cluster already running default-deny.helm lintclean both ways.Remaining #3387 gaps after this
kubernetesService maps 443→targetPort 6443 and Cilium evaluates policy after kube-proxy-replacement DNAT, so a rule allowing only 443 is silently dropped). Probably deserves its own issue.🧹 Checklist
helm lint/helm templateagainst the rendered webhook chart